I think a decently crafted capability URL should be enough security for 99% of password resets. Theoretically your mail provider could just use the link to cap

I think a decently crafted capability URL should be enough security for 99% of password resets. Theoretically your mail provider could just use the link to capture your account. Since accessing and scanning private data has been normalized by Google and co., that might not be the case anymore. But we used that practice for decades and I am not aware of any abuses. Inherently insecure is giving services your mobile contact data. This makes any form of data leak much more damaging to you. "Security" has been perverted for years now... Many 2FA systems aren't really convincing in my opinion and case like this https://www.techdirt.com/articles/20200804/01231345032/twitter-about-to-be-hit-with-250-million-fine-using-your-two-factor-authentication-phone-numbers-emails-marketing.shtml https://www.techdirt.com/articles/20200804/01231345032/twitt... are much more damaging than many trojans on PC systems. 2FA is a security breach, not a security feature. There was no abuse of capability URLs to my knowledge for decades. Twitter probably didn't even need a year to abuse 2FA. Be smart about IT security...